CVE-2026-60594

PeopleSoft Enterprise CS Campus Community version 9.2.38 has a vulnerability in the Security component. A difficult-to-exploit flaw allows an unauthenticated attacker with access to the physical communication segment to gain unauthorized access to critical data and partially modify data.

PeopleSoft Enterprise CS Campus Community (part of Oracle PeopleSoft) version 9.2.38 has a difficult-to-exploit vulnerability that can be used by a low-privileged attacker via HTTP. Successful attack can result in unauthorized access, data modification, and complete denial of service (hang or frequent crashes).

Vulnerability in Oracle PeopleSoft Enterprise CS Campus Community (component: Security) version 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to read a subset of data. CVSS 5.3 (Confidentiality impact).

Vulnerability in Oracle PeopleSoft Enterprise CS Campus Community (component: Security) version 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to access critical data or all data. CVSS 5.9 (Confidentiality impact).

Vulnerability in PeopleSoft Enterprise CS Campus Community (version 9.2.38) in Security component. Difficult to exploit, low-privileged attacker via HTTP can take over the system.

Vulnerability in PeopleSoft Enterprise CS Campus Community product (component: Integration and Interfaces) versions 9.0 and 9.2. Allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data.

Vulnerability in PeopleSoft Enterprise CS Campus Community product (component: Self-Service) version 9.2. Allows a low privileged attacker with network access via HTTP to gain unauthorized read access to a subset of data, potentially impacting additional products.

Vulnerability in PeopleSoft Enterprise CS Campus Community component (subcomponent: Frameworks) version 9.2. Allows a high privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, modification, or access to critical data.